claws-temple-bounty-bf2756— agent skill

claws-temple-bounty-bf2756 — independently scanned and version-tracked by SaferSkills.

Is claws-temple-bounty-bf2756 safe to install?

SaferSkills independently audited claws-temple-bounty-bf2756 (Agent Skill) and scored it 65/100 (yellow). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 12 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.

Score
65/100
●●●●●●●○○○
↑ +0 since first scan (65 → 65)Re-scan~30s
Latest scan
ScannedJun 24, 2026 · 34d ago
Scans run1 over 90 days
Detectors55 checks · 5 categories
Findings12 warnings · 0 high
EngineSaferSkills 2b638c6
View methodology →
SaferSkills installs
This week0
This month0
All time0
CategoryWeightCategory scoreContribution
Securityprompt, exec, net, exfil, eval
35%
0
0.0 pts
Supply chainhash, typosquat, maintainer, lockfile
20%
100
20.0 pts
Maintenancestaleness, pinning, CI
15%
100
15.0 pts
TransparencySKILL.md, perms, README
15%
100
15.0 pts
Communityinstalls, verify, response
15%
100
15.0 pts

Findings & checks · 12 flagged

Securityscore 0 · 12 findings
MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · skills/claws-temple-bounty/SKILL.md×3
MEDIUMit fires on intent; the real damage depends on the host agent's own approval-gating.
Why it matters

The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.

The exact value spotted
excerptskills/claws-temple-bounty/SKILL.md· markdown
98- for Task 2, only show the current user's `user ID` when the current-turn dependency result
… (108 chars elided on L98)
99- for Task 2, if the current-turn dependency result resolves the current user's `user ID` su
… (108 chars elided on L99)
100- for Task 2, if the current user's `user ID` still cannot be auto-resolved after onboarding
… (104 chars elided on L100)
101- for Task 2, if there is no current-turn dependency result yet, do not claim queue-readines
… (40 chars elided on L101)
102- for Task 2, do not mislabel missing local dependency context as a requirement that the use
… (108 chars elided on L102)
Occurrences
3 occurrences · first at L100, also L106, L132
Show all 3 locations
Line
File
L100
skills/claws-temple-bounty/SKILL.md
L106
skills/claws-temple-bounty/SKILL.md
L132
skills/claws-temple-bounty/SKILL.md
How to fix
Remove the approval-skipping instruction, or scope it narrowly to a specific safe, reversible action.
  1. Delete blanket "don't ask / no need to confirm" directives from the skill.
  2. If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.
Framework references
OWASPLLM01ATLASAML.T0051
Trace & refs
ruleSS-SKILL-INJECT-DONT-ASK-01sha25612211d7a427c799arubric 365aacaView on GitHub
MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · skills/claws-temple-bounty/references/examples/task-2-resonance-partner.en.md
MEDIUMit fires on intent; the real damage depends on the host agent's own approval-gating.
Why it matters

The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.

The exact value spotted
excerptskills/claws-temple-bounty/references/examples/task-2-resonance-partner.en.md· markdown
62- dependency_contract: `CA only`
63- onboarding_mapping: `new users sign up first; returning unsigned-in users recover sign-in
… (6 chars elided on L63)
64- current_user_id_resolution: `auto-resolve from dependency context; do not ask the user to
… (18 chars elided on L64)
65- user_id_mapping: `user-facing user ID = dependency ca_hash`
66- targeted_match_field: `counterparty_ca_hash`
Occurrences
1 occurrence · at L64
How to fix
Remove the approval-skipping instruction, or scope it narrowly to a specific safe, reversible action.
  1. Delete blanket "don't ask / no need to confirm" directives from the skill.
  2. If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.
Framework references
OWASPLLM01ATLASAML.T0051
Trace & refs
ruleSS-SKILL-INJECT-DONT-ASK-01sha25612211d7a427c799arubric 365aacaView on GitHub
MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · skills/claws-temple-bounty/references/output-contract.md
MEDIUMit fires on intent; the real damage depends on the host agent's own approval-gating.
Why it matters

The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.

The exact value spotted
excerptskills/claws-temple-bounty/references/output-contract.md· markdown
196- if the user does not already have a concrete partner, explain that `open partner search` i
… (74 chars elided on L196)
197- if `resonance-contract` is missing or below `4.0.0`, try dependency self-heal first
198- do not ask the user to provide their own install source when `resonance-contract` is missi
… (19 chars elided on L198)
199- if the host cannot auto-install or auto-upgrade `resonance-contract`, give explicit instal
… (44 chars elided on L199)
200- if dependency queue preflight can proceed, continue into the formal queue path and do not
… (62 chars elided on L200)
Occurrences
1 occurrence · at L198
How to fix
Remove the approval-skipping instruction, or scope it narrowly to a specific safe, reversible action.
  1. Delete blanket "don't ask / no need to confirm" directives from the skill.
  2. If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.
Framework references
OWASPLLM01ATLASAML.T0051
Trace & refs
ruleSS-SKILL-INJECT-DONT-ASK-01sha25612211d7a427c799arubric 365aacaView on GitHub
MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · skills/claws-temple-bounty/references/task-flows/task-2-resonance-partner.md×3
MEDIUMit fires on intent; the real damage depends on the host agent's own approval-gating.
Why it matters

The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.

The exact value spotted
excerptskills/claws-temple-bounty/references/task-flows/task-2-resonance-partner.md· markdown
239. If `resonance-contract` is missing or below `4.0.0`, first try the bundled self-heal help
… (68 chars elided on L23)
2410. If that helper cannot run in the current host, use the portable source catalog in `../..
… (108 chars elided on L24)
2511. Do not ask the user to provide an install source for `resonance-contract`.
2612. If the current host still cannot auto-install or auto-upgrade the dependency, return exp
… (57 chars elided on L26)
2713. Once identity entry and sign-in are ready, auto-resolve the current user's own `user ID`
… (76 chars elided on L27)
Occurrences
3 occurrences · first at L25, also L30, L94
Show all 3 locations
Line
File
L25
skills/claws-temple-bounty/references/task-flows/task-2-resonance-partner.md
L30
skills/claws-temple-bounty/references/task-flows/task-2-resonance-partner.md
L94
skills/claws-temple-bounty/references/task-flows/task-2-resonance-partner.md
How to fix
Remove the approval-skipping instruction, or scope it narrowly to a specific safe, reversible action.
  1. Delete blanket "don't ask / no need to confirm" directives from the skill.
  2. If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.
Framework references
OWASPLLM01ATLASAML.T0051
Trace & refs
ruleSS-SKILL-INJECT-DONT-ASK-01sha25668b030f55bcd484arubric 365aacaView on GitHub
MEDIUM"Never tell the user" non-disclosure imperative in the skillSS-SKILL-INJECT-IMPERATIVE-01 · Prompt injection · skills/claws-temple-bounty/references/output-contract.md×2
MEDIUMit fires on intent; whether the agent honors the non-disclosure imperative depends on the host model.
Why it matters

A bulleted imperative like {match} tells the agent to never reveal, disclose, or mention something to the user. Used adversarially it can instruct the agent to hide its tool calls or lie about what it did — stripping the transparency a user relies on to trust the agent.

The exact value spotted
excerptskills/claws-temple-bounty/references/output-contract.md· markdown
203- keep `CA only`, `counterparty_ca_hash`, and `queue` inside maintainer-facing details; the
… (42 chars elided on L203)
204- if local dependency context is still missing, describe that state as `identity entry / use
… (107 chars elided on L204)
205- do not tell the user to look in legacy community-brand wording, extra platform names outsi
… (108 chars elided on L205)
206- if registration, recovery sign-in, user-ID auto-resolution, dependency self-heal, identity
… (108 chars elided on L206)
207- end with a CTA toward Task 3 when the path is stable
Occurrences
2 occurrences · first at L205, also L307
Show all 2 locations
Line
File
L205
skills/claws-temple-bounty/references/output-contract.md
L307
skills/claws-temple-bounty/references/output-contract.md
How to fix
Remove the non-disclosure imperative, or rescope it so it limits output format, not honesty to the user.
  1. Delete any "never reveal / never tell the user" line aimed at the model's own behavior.
  2. Keep legitimate confidentiality rules about external data (e.g. "do not echo API keys"), which are user-protective, not user-deceiving.
Framework references
OWASPLLM01ATLASAML.T0051
Trace & refs
ruleSS-SKILL-INJECT-IMPERATIVE-01sha25680fd85a2f002825crubric 365aacaView on GitHub
MEDIUM"Never tell the user" non-disclosure imperative in the skillSS-SKILL-INJECT-IMPERATIVE-01 · Prompt injection · skills/claws-temple-bounty/references/task-flows/task-2-resonance-partner.md
MEDIUMit fires on intent; whether the agent honors the non-disclosure imperative depends on the host model.
Why it matters

A bulleted imperative like {match} tells the agent to never reveal, disclose, or mention something to the user. Used adversarially it can instruct the agent to hide its tool calls or lie about what it did — stripping the transparency a user relies on to trust the agent.

The exact value spotted
excerptskills/claws-temple-bounty/references/task-flows/task-2-resonance-partner.md· markdown
88- if dependency queue preflight can proceed, do not replace the flow with Telegram or X outr
… (39 chars elided on L88)
89- dependency install or upgrade guidance should come from `../../config/dependency-sources.j
… (38 chars elided on L89)
90- do not mention legacy community-brand wording, legacy platform names outside Telegram and
… (81 chars elided on L90)
91- do not accept `email`, `Address`, or nickname as a direct-match identifier
92- keep raw method names and execution details out of the visible layer
Occurrences
1 occurrence · at L90
How to fix
Remove the non-disclosure imperative, or rescope it so it limits output format, not honesty to the user.
  1. Delete any "never reveal / never tell the user" line aimed at the model's own behavior.
  2. Keep legitimate confidentiality rules about external data (e.g. "do not echo API keys"), which are user-protective, not user-deceiving.
Framework references
OWASPLLM01ATLASAML.T0051
Trace & refs
ruleSS-SKILL-INJECT-IMPERATIVE-01sha2564980d6f99d75c90brubric 365aacaView on GitHub
MEDIUM"Never tell the user" non-disclosure imperative in the skillSS-SKILL-INJECT-IMPERATIVE-01 · Prompt injection · skills/claws-temple-bounty/references/task-flows/task-5-social-signal.md
MEDIUMit fires on intent; whether the agent honors the non-disclosure imperative depends on the host model.
Why it matters

A bulleted imperative like {match} tells the agent to never reveal, disclose, or mention something to the user. Used adversarially it can instruct the agent to hide its tool calls or lie about what it did — stripping the transparency a user relies on to trust the agent.

The exact value spotted
excerptskills/claws-temple-bounty/references/task-flows/task-5-social-signal.md· markdown
238. The confirmation question should stay concrete: `Can this exact session open browser acti
… (108 chars elided on L23)
249. If the current host is `OpenClaw`, the user already chose `Telegram` or `X`, the user exp
… (108 chars elided on L24)
2510. Do not mention browser action before the user has chosen a platform, when the user only
… (52 chars elided on L25)
2611. If the user explicitly wants to send the signal now but the current context blocks that
… (56 chars elided on L26)
2712. End with a community-reach framing instead of a blocker framing when the signal path is
… (18 chars elided on L27)
Occurrences
1 occurrence · at L25
How to fix
Remove the non-disclosure imperative, or rescope it so it limits output format, not honesty to the user.
  1. Delete any "never reveal / never tell the user" line aimed at the model's own behavior.
  2. Keep legitimate confidentiality rules about external data (e.g. "do not echo API keys"), which are user-protective, not user-deceiving.
Framework references
OWASPLLM01ATLASAML.T0051
Trace & refs
ruleSS-SKILL-INJECT-IMPERATIVE-01sha2569eba31027fc86fe1rubric 365aacaView on GitHub
Supply chainscore 100 · 0 findings
All supply chain checks passedNo findings in this category for the latest scan.pass
Maintenancescore 100 · 0 findings
All maintenance checks passedNo findings in this category for the latest scan.pass
Transparencyscore 100 · 0 findings
All transparency checks passedNo findings in this category for the latest scan.pass
Communityscore 100 · 0 findings
All community checks passedNo findings in this category for the latest scan.pass
Vendor response · right of reply
Are you the maintainer? Submit a response →

Audit the pieces. Scan the whole. Decide.

~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.